Is CVE-2026-110759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110759 being exploited in the wild.

How severe is CVE-2026-110759?

Informational severity, published 16 October 2026.

Is there a fix for CVE-2026-110759?

Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110759 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-110759?

Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110759: Text::CSV_XS incorrect byte returned for empty field with trailing CR

CVE-2026-110759 · Severity: info · Published 2026-10-16

Text::CSV_XS is a Perl library that parses CSV (comma-separated values) data. When parsing CSV text that ends with a separator followed by a carriage return (CR), the library incorrectly inserts a 0xFF byte into the parsed output that was not in the original input. This can cause applications to receive corrupted data, particularly in UTF-8 contexts where the byte represents malformed encoding.

Technologies: CPAN Text::CSV XS. Vendors: CPAN.

Quick answers

Is CVE-2026-110759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110759 being exploited in the wild.
How severe is CVE-2026-110759?: Informational severity, published 16 October 2026.
Which products and versions are affected?: CPAN Text::CSV XS before 1.65.
Is there a fix for CVE-2026-110759?: Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110759 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-110759?: Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.65

Technical details

The vulnerability occurs in the parse() method when input ends with a separator and a lone CR character. The parser incorrectly treats the end-of-file marker as a data byte (0xFF) instead of reporting an error as it does for non-empty final fields. This affects binary mode and UTF-8 flagged input differently: binary mode returns the literal 0xFF byte, while UTF-8 mode returns a malformed UTF-8 string containing that byte. The fix (version 1.65) adds validation in parse()-only mode to report error 2032 for trailing lone CR, matching the behavior of non-empty fields and preventing EOF from being stored as data.

Affected products

CPAN Text::CSV_XS before 1.65

Timeline

2026-10-16: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.